update initial brk guess

Namely, put it after .text *or* .data, whichever comes last.

The original logic there was to put it after .data, but riscv toolchain
manages to put .text after .data, forcing qemu to squeeze the heap
between them.

https://github.com/riscv/riscv-binutils-gdb/blob/riscv-binutils-2.27/ld/emulparams/elf32lriscv-defs.sh#L29-L30

linux-user/elfload.c

@@ -1976,9 +1976,6 @@ static void load_elf_image(const char *image_name, int image_fd,
                 if (vaddr_ef > info->end_data) {
                     info->end_data = vaddr_ef;
                 }
-                if (vaddr_em > info->brk) {
-                    info->brk = vaddr_em;
-                }
             }
         } else if (eppnt->p_type == PT_INTERP && pinterp_name) {
             char *interp_name;
@@ -2013,9 +2010,12 @@ static void load_elf_image(const char *image_name, int image_fd,
     if (info->end_data == 0) {
         info->start_data = info->end_code;
         info->end_data = info->end_code;
-        info->brk = info->end_code;
     }
 
+    /* Heap should be located past both .text and .data */
+    info->brk = (info->end_code > info->end_data ?
+            info->end_code : info->end_data);
+
     if (qemu_log_enabled()) {
         load_symbols(ehdr, image_fd, load_bias);
     }